warren-bank
commented
1 year ago You make a good point.
According to this unofficial spec, AirPlay v1 did support Digest access authentication.
Here is a super quick (untested) example of how it could be implemented..
-
code
- unmodified method that bootstraps playback
public void playVideo(URL location, ServiceInfo serviceInfo) throws Exception { if (serviceInfo == null) { throw new Exception("Not connected to AirPlay service"); } es.submit(new PlayVideoTask(location, serviceInfo)); } -
modified method that handles authentication
import java.security.MessageDigest; import java.util.HashMap; import java.util.Map; import java.util.regex.Matcher; import java.util.regex.Pattern; private class PlayVideoTask implements Runnable { private URL location; private ServiceInfo serviceInfo; public PlayVideoTask(URL location, ServiceInfo serviceInfo) { this.location = location; this.serviceInfo = serviceInfo; } @Override public void run() { sendRequest(null); } private void sendRequest(Map<String, String> reqHeaders) { try { StringBuilder content = new StringBuilder(); content.append("Content-Location: "); content.append(location.toString()); content.append("\n"); content.append("Start-Position: 0\n"); URL url = new URL(serviceInfo.getURL() + "/play"); HttpURLConnection conn = (HttpURLConnection) url.openConnection(); conn.setDoInput(true); conn.setDoOutput(true); conn.setConnectTimeout(15 * 1000); conn.setReadTimeout(15 * 1000); conn.setRequestMethod("POST"); conn.setRequestProperty("Content-Length", "" + content.length()); conn.setRequestProperty("Content-Type", "text/parameters"); conn.setRequestProperty("X-Apple-AssetKey", UUID.randomUUID().toString()); conn.setRequestProperty("X-Apple-Session-ID", UUID.randomUUID().toString()); conn.setRequestProperty("User-Agent", "MediaControl/1.0"); if (reqHeaders != null) { for (Map.Entry<String, String> reqHeader : reqHeaders.entrySet()) { conn.setRequestProperty(reqHeader.getKey(), reqHeader.getValue()); } } BufferedOutputStream out = new BufferedOutputStream(conn.getOutputStream()); out.write(content.toString().getBytes()); out.close(); int status = conn.getResponseCode(); if (status == 401) { sendAuthRequest(reqHeaders, conn); return; } if (callback != null) { if (status == 200) callback.onPlayVideoSuccess(location); else callback.onPlayVideoError(location, "AirPlay service responded HTTP " + status); } } catch (Exception e) { if (callback != null) callback.onPlayVideoError(location, e.getMessage()); } } private void sendAuthRequest(Map<String, String> reqHeaders, HttpURLConnection conn) { // TODO: replace hard coded password with a UI prompt String password = "1234"; if (reqHeaders == null) { reqHeaders = (Map<String, String>) new HashMap<String, String>(); } // https://developer.android.com/reference/java/net/URLConnection#getHeaderField(java.lang.String) String resHeaderAuth = conn.getHeaderField("WWW-Authenticate"); if (resHeaderAuth != null) { Pattern regex = Pattern.compile("^.*nonce=\"([^\"]+)\".*$"); Matcher match = regex.matcher(resHeaderAuth); if (match.find()) { String nonce = match.group(1); // HA1 = MD5(username:realm:password) // HA2 = MD5(method:digestURI) // response = MD5(HA1:nonce:HA2) String HA1 = MD5("AirPlay:AirPlay:" + password); String HA2 = MD5("POST:/play"); String response = MD5(HA1 + ":" + nonce + ":" + HA2); String reqHeaderAuthName = "Authorization"; String reqHeaderAuthValue = "Digest username=\"AirPlay\", realm=\"AirPlay\", nonce=\"" + nonce + "\", uri=\"/play\", response=\"" + response + "\""; reqHeaders.put(reqHeaderAuthName, reqHeaderAuthValue); sendRequest(reqHeaders); } } } // http://fancifulandroid.blogspot.com/2014/01/android-convert-string-to-md5-properly.html // https://stackoverflow.com/a/21333739 private static String MD5(String md5) { try { MessageDigest md = MessageDigest.getInstance("MD5"); byte[] array = md.digest(md5.getBytes("UTF-8")); StringBuffer sb = new StringBuffer(); for (int i = 0; i < array.length; ++i) { sb.append(Integer.toHexString((array[i] & 0xFF) | 0x100).substring(1,3)); } return sb.toString(); } catch (Exception e) { return null; } } }
- unmodified method that bootstraps playback
You could test whether or not Digest authentication will work with your target receiver by hand crafting the "Authorization" request header and using curl for a command-line client.
Such a test would be super fast and a good way to test what does (and doesn't) work. Once a solution is found that works when constructed manually.. the same methodology could be applied by the app. Conversely, the methodology that I implemented above could be easily converted to a bash script and tested without any build step.
mjray
knishant362
The airplay target I'm trying to control has only options to ask for a PIN or password on first connection or every connection, with no option to never ask for one, so I can't control it because everything fails with a 403 HTTP status code (thanks for the toast saying that, rather than a less clear error!). I also can't hack the device because it's not mine (and its developers suck anyway).
Is it possible to add a PIN or password as a setting in this client, please? Either per-device or even systemwide would solve my problem.
Or is there even a default hardcoded? I browsed the code and didn't find it, but I'm not great at Android coding.